From dc778020fce3f4c9bd05254af9854611dbd16e80 Mon Sep 17 00:00:00 2001 From: johzzy Date: Sun, 26 Sep 2021 17:01:53 +0800 Subject: [PATCH] fix some crash in rtc. (#2545) --- trunk/src/app/srs_app_rtc_source.cpp | 4 ++++ trunk/src/kernel/srs_kernel_rtc_rtcp.cpp | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/trunk/src/app/srs_app_rtc_source.cpp b/trunk/src/app/srs_app_rtc_source.cpp index 4ac4d53d2..be1c15adf 100644 --- a/trunk/src/app/srs_app_rtc_source.cpp +++ b/trunk/src/app/srs_app_rtc_source.cpp @@ -1715,6 +1715,10 @@ bool SrsRtmpFromRtcBridger::check_frame_complete(const uint16_t start, const uin for (uint16_t i = 0; i < cnt; ++i) { int index = cache_index((start + i)); SrsRtpPacket* pkt = cache_video_pkts_[index].pkt; + if (!pkt) { + // fix crash when pkt->payload() if pkt is nullptr; + continue; + } SrsRtpFUAPayload2* fua_payload = dynamic_cast(pkt->payload()); if (fua_payload) { if (fua_payload->start) { diff --git a/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp b/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp index 129701aea..1c9f14c76 100644 --- a/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp +++ b/trunk/src/kernel/srs_kernel_rtc_rtcp.cpp @@ -1167,9 +1167,17 @@ srs_error_t SrsRtcpTWCC::do_encode(SrsBuffer *buffer) buffer->write_3bytes(reference_time_); buffer->write_1bytes(fb_pkt_count_); + int required_size = encoded_chucks_.size() * 2; + if(!buffer->require(required_size)) { + return srs_error_new(ERROR_RTC_RTCP, "encoded_chucks_[%d] requires %d bytes", (int)encoded_chucks_.size(), required_size); + } for(vector::iterator it = encoded_chucks_.begin(); it != encoded_chucks_.end(); ++it) { buffer->write_2bytes(*it); } + required_size = pkt_deltas_.size() * 2; + if(!buffer->require(required_size)) { + return srs_error_new(ERROR_RTC_RTCP, "pkt_deltas_[%d] requires %d bytes", (int)pkt_deltas_.size(), required_size); + } for(vector::iterator it = pkt_deltas_.begin(); it != pkt_deltas_.end(); ++it) { if(0 <= *it && 0xFF >= *it) { // small delta